Overview

overview

10

Static

static

7

3ddb43b421...4e.apk

android_x86

10

3ddb43b421...4e.apk

android_x64

10

3ddb43b421...4e.apk

android_x64

10

Analysis

  • max time kernel
    2558349s
  • max time network
    126s
  • platform
    android_x86
  • resource
    android-x86-arm-20220621-en
  • submitted
    25-06-2022 01:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3ddb43b421adc9d90502d39ce68a76a3ed9addcc7866f270deb3d8effefa9e4e.apk

  • Size

    2.9MB

  • MD5

    ac78fe3a2934efdfda73727906502f6a

  • SHA1

    ce34fa87b1020f5706b460453922e719b155184f

  • SHA256

    3ddb43b421adc9d90502d39ce68a76a3ed9addcc7866f270deb3d8effefa9e4e

  • SHA512

    a21633fef057a9c03ced6a941d10bc622cb14ce6e51069087a36a8dcf495d369bdbb431ba6b31cb37b957492ed7199075ff666228f322b9dd0a8827aa35f361e

Score
10/10
anubisbankerevasioninfostealertrojan

Malware Config

Extracted

Family

anubis

C2

http://xyz5xyz.ru

Signatures

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
    evasion

Processes

  • qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Listens for changes in the sensor environment (might be used to detect emulation).
    PID:4585
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/PwO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/oat/x86/PwO.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/PwO.json
    Filesize

    1.1MB

    MD5

    1bf371df8039cf9dd9969676e3e68cee

    SHA1

    7ac73763481f66dc744d1329f983e765b5b530bb

    SHA256

    5b62cd3de8b4303723a11105e369da98bfad52cc7cfbe34065ac896371d10cc1

    SHA512

    7c9f6bf767fcfc56bccc236f0ad98c7af6ecddd2084945201f2bdf22bdc60fae228fad2994460d674eb57dc7d5b0e3e28d8133ddfc6a5c1f5cc9e884145b05f7

    Download Submit
  • /data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/PwO.json
    Filesize

    1.1MB

    MD5

    27c934a731fa515726efdfa96c55bd18

    SHA1

    b24bd3dce2f05ab3b64e342390b80d55dec979c4

    SHA256

    4b0e8c71237a2be2fc8380f87e081cf8ab687f59a1b7455f3095f5fa45bfa2c9

    SHA512

    04959e2a1ae7682151dc1a811a5db23bbd99c0519c30aae0b21f16c6d76b6f3a3b497e9e59d9d35940ec471740d379c52a93599ab1119a60b92bd12e96415602

    Download Submit
  • /data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/PwO.json
    Filesize

    1.1MB

    MD5

    a034e40e932d8af16cd6ef4da80c82e2

    SHA1

    340d9ea359cba6d5f871c99345e5c6fed0e94fb0

    SHA256

    cd31323d25c5fcb2160b75f8b3499142130a7743dfc0ad3fc35ba666f71e3d8f

    SHA512

    5f6d78c6152bd6b56488ed62afdcba2c696b76b4140d83be4de3c132aa27cb5949aaf58a2e2a9c407cbc8491a67b7cb9a6281f2243a7c16a96fa514b54f31477

    Download Submit
  • /data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/PwO.json
    Filesize

    1.1MB

    MD5

    27c934a731fa515726efdfa96c55bd18

    SHA1

    b24bd3dce2f05ab3b64e342390b80d55dec979c4

    SHA256

    4b0e8c71237a2be2fc8380f87e081cf8ab687f59a1b7455f3095f5fa45bfa2c9

    SHA512

    04959e2a1ae7682151dc1a811a5db23bbd99c0519c30aae0b21f16c6d76b6f3a3b497e9e59d9d35940ec471740d379c52a93599ab1119a60b92bd12e96415602

    Download Submit
  • /data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/PwO.json.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/oat/PwO.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/oat/x86/PwO.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/oat/x86/PwO.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit